Adversary Intelligence — 2026-10-26

GRU-Linked Sandworm Hackers Wiped Data at Ukrainian Grain Logistics Company Using Novel Malware

BLUFSandworm's handoff from espionage access to destructive wipe confirms Ukrainian agricultural infrastructure faces coordinated multi-group operations designed to disrupt grain logistics.

ESET reported on October 22 that UAC-0099 gained initial access to a Ukrainian grain logistics company on July 16, 2025, through a spear-phishing attachment that launched the MATCHBOIL and MATCHWOK chain 12. The next day the intruders deployed MythicRatatoskr, a previously unknown Go-based backdoor whose command-and-control server sat inside the Yggdrasil mesh network 1. ESET called this the first documented abuse of Yggdrasil by a state-aligned actor, and researcher Anton Cherepanov said the backdoor has not been seen elsewhere 13. ESET attributed the data wiping, run with SDelete through centrally pushed network commands on September 17, to Sandworm (GRU Unit 74455) with high confidence, and said it could not determine which group operated the backdoor 24. The victim has not been named and the extent of damage is undisclosed 24.

Analysis
UAC-0099 and Sandworm worked in sequence against the grain company, so espionage-grade intrusions in Ukrainian agriculture and logistics should be treated as possible staging for later wiping. The two-month gap between the July phishing compromise and the September wipe suggests access was held, then used by a second party. UAC-0099 may instead be a Sandworm-controlled access cluster under single GRU tasking, not an independent partner. Command-and-control inside Yggdrasil removes the single server that blocklists and takedowns target, so detection must rest on endpoint behavior and on blocking Yggdrasil traffic where it has no business use. Yggdrasil does not anonymize users, leaving attribution open to investigators. Confidence is high: ESET's primary report is matched by three outlets on dates, tooling and attribution, though they largely echo ESET, and the unnamed victim and undisclosed damage limit impact assessment.

4 sources

Russia-aligned UAC-0099 and Sandworm cooperate in wiping attack against Ukraine, ESET Research discovers - ESET (GlobeNewswire)
GRU-linked hackers wiped data at Ukrainian grain company after two-month intrusion, ESET reports - The Insider
Russian hackers teamed up to wipe data at Ukrainian grain firm - The Record
ESET says Russia-linked hackers hid malware traffic in Yggdrasil network - The Next Web